More Efficient Sybil Detection Mechanisms Leveraging Resistance of Users to Attack Requests

TL;DR

The paper tackles sybil detection in OSNs by introducing a user-resistance concept that governs how benign users respond to sybil friend requests, enabling a dynamic data-generation framework with attacker strategies. It formalizes two preprocessing problems—maximizing benign discoveries (MB) and discovering potential attack edges (PAE)—and provides algorithmic solutions, including a greedy baseline, Monte Carlo Greedy, and a novel Traversing algorithm, along with hardness results (MB is #P-hard) and a linear-time PAE solver. The work demonstrates that resistance-informed preprocessing substantially improves the performance of state-of-the-art sybil detectors (e.g., SybilSCAR, SybilWalk, SybilMetric) across multiple real-world benign networks, highlighting practical gains and scalability. Overall, resistance-based preprocessing offers a principled, scalable pre-step that strengthens graph-based sybil detection in realistic, heterogenous network structures, with public code and data to facilitate adoption and further research.

Abstract

We investigate the problem of sybil (fake account) detection in social networks from a graph algorithms perspective, where graph structural information is used to classify users as sybil and benign. We introduce the novel notion of user resistance to attack requests (friendship requests from sybil accounts). Building on this notion, we propose a synthetic graph data generation framework that supports various attack strategies. We then study the optimization problem where we are allowed to reveal the resistance of a subset of users with the aim to maximize the number of users which are discovered to be benign and the number of potential attack edges (connections from a sybil to a benign user). Furthermore, we devise efficient algorithms for this problem and investigate their theoretical guarantees. Finally, through a large set of experiments, we demonstrate that our proposed algorithms improve detection performance notably when applied as a preprocessing step for different sybil detection algorithms. The code and data used in this work are publicly available on GitHub https://github.com/aSafarpoor/AAMAS2025-Paper/tree/main

Figures (8)

• Figure 2: The number of discovered benigns by each algorithm when the budget ranges from $1$ to $k$ in the maximizing benigns problem on the Facebook dataset and for different attack strategies.
• Figure 3: The number of discovered PAEs for different budgets (first row) and the percentage of attack edges relative to the number of discovered PAEs (second row) on the Facebook dataset. Each column represents a different attack strategy.
• Figure B.1: The graph outcome of transformer where $S=\emptyset$ and $V_Q=B$.
• Figure D.1: An example to show $f(\cdot)$ is not submodular.
• Figure H.1: Data structure schema used to update neighborhoods in Algorithm \ref{['algorithm:TraversingResistanceDegreeAware']}. First, starting from $a$ with purple lines, we can reach $d$ and $f$ on the right side table, and then based on three lines shown by blue, orange, and pink lines, we can apply the updates.

Theorems & Definitions (7)

• Definition 3.1
• Definition 3.2: Maximum Coverage (MC) Problem
• Theorem 3.1: Fiege1998Athreshhold
• Theorem 3.2
• Theorem 3.3
• Definition 3.3
• Theorem F.1: Hoeffding's inequality hoeffding1994probability